Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade firebase/php-jwt to ^6.0 #388

Closed
wants to merge 1 commit into from
Closed

Upgrade firebase/php-jwt to ^6.0 #388

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion composer.json
View file
Open in desktop
Expand Up @@ -10,7 +10,7 @@
},
"require": {
"php": ">=5.6",
"firebase/php-jwt": "~5.0",
"firebase/php-jwt": "^6.0",
"guzzlehttp/guzzle": "^6.2.1|^7.0",
"guzzlehttp/psr7": "^1.7|^2.0",
"psr/http-message": "^1.0",
Expand Down
13 changes: 7 additions & 6 deletions src/OAuth2.php
View file
Open in desktop
Expand Up @@ -18,6 +18,7 @@
namespace Google\Auth;

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Google\Auth\HttpHandler\HttpClientCache;
use Google\Auth\HttpHandler\HttpHandlerFactory;
use GuzzleHttp\Psr7\Query;
Expand Down Expand Up @@ -380,7 +381,7 @@ public function __construct(array $config)
* `\InvalidArgumentException`.
*
* @param string $publicKey The public key to use to authenticate the token
* @param array $allowed_algs List of supported verification algorithms
* @param string $allowed_alg The supported verification algorithm
* @throws \DomainException if the token is missing an audience.
* @throws \DomainException if the audience does not match the one set in
* the OAuth2 class instance.
Expand All @@ -390,14 +391,14 @@ public function __construct(array $config)
* @throws ExpiredException If the token has expired.
* @return null|object
*/
public function verifyIdToken($publicKey = null, $allowed_algs = array())
public function verifyIdToken($publicKey = null, $allowed_alg)
{
$idToken = $this->getIdToken();
if (is_null($idToken)) {
return null;
}

$resp = $this->jwtDecode($idToken, $publicKey, $allowed_algs);
$resp = $this->jwtDecode($idToken, $publicKey, $allowed_alg);
if (!property_exists($resp, 'aud')) {
throw new \DomainException('No audience found the id token');
}
Expand Down Expand Up @@ -1377,12 +1378,12 @@ private function coerceUri($uri)
/**
* @param string $idToken
* @param string|array|null $publicKey
* @param array $allowedAlgs
* @param string $allowedAlg
* @return object
*/
private function jwtDecode($idToken, $publicKey, $allowedAlgs)
private function jwtDecode($idToken, $publicKey, $allowedAlg)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unfortunately this is a backwards breaking change.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought that might be the case. Thanks for the feedback and for the work done in #391. Ultimately, I just need the issue fixed 馃槃

{
return JWT::decode($idToken, $publicKey, $allowedAlgs);
return JWT::decode($idToken, new Key($publicKey, $allowedAlg));
}

private function jwtEncode($assertion, $signingKey, $signingAlgorithm, $signingKeyId = null)
Expand Down
3 changes: 2 additions & 1 deletion tests/Credentials/ServiceAccountCredentialsTest.php
View file
Open in desktop
Expand Up @@ -19,6 +19,7 @@

use DomainException;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Google\Auth\ApplicationDefaultCredentials;
use Google\Auth\Credentials\ServiceAccountCredentials;
use Google\Auth\Credentials\ServiceAccountJwtAccessCredentials;
Expand Down Expand Up @@ -800,7 +801,7 @@ public function testJwtAccessFromApplicationDefault()
$token = str_replace('Bearer ', '', $metadata['authorization'][0]);
$key = file_get_contents(__DIR__ . '/../fixtures3/key.pub');

$result = JWT::decode($token, $key, ['RS256']);
$result = JWT::decode($token, new Key($key, 'RS256'));

$this->assertEquals($authUri, $result->aud);
}
Expand Down
25 changes: 16 additions & 9 deletions tests/OAuth2Test.php
View file
Open in desktop
Expand Up @@ -19,6 +19,7 @@

use DomainException;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Google\Auth\OAuth2;
use GuzzleHttp\Psr7\Query;
use GuzzleHttp\Psr7\Utils;
Expand Down Expand Up @@ -450,7 +451,10 @@ public function testCanHS256EncodeAValidPayloadWithSigningKeyId()
$testConfig['signingKeyId'] = 'example_key_id2';
$o = new OAuth2($testConfig);
$payload = $o->toJwt();
$roundTrip = JWT::decode($payload, $keys, array('HS256'));
$roundTrip = JWT::decode($payload, array(
'example_key_id1' => new Key('example_key1', 'HS256'),
'example_key_id2' => new Key('example_key2', 'HS256')
));
$this->assertEquals($roundTrip->iss, $testConfig['issuer']);
$this->assertEquals($roundTrip->aud, $testConfig['audience']);
$this->assertEquals($roundTrip->scope, $testConfig['scope']);
Expand All @@ -468,7 +472,10 @@ public function testFailDecodeWithoutSigningKeyId()
$payload = $o->toJwt();

try {
JWT::decode($payload, $keys, array('HS256'));
JWT::decode($payload, array(
'example_key_id1' => new Key('example_key1', 'HS256'),
'example_key_id2' => new Key('example_key2', 'HS256')
));
} catch (\Exception $e) {
// Workaround: In old JWT versions throws DomainException
$this->assertTrue(
Expand All @@ -485,7 +492,7 @@ public function testCanHS256EncodeAValidPayload()
$testConfig = $this->signingMinimal;
$o = new OAuth2($testConfig);
$payload = $o->toJwt();
$roundTrip = JWT::decode($payload, $testConfig['signingKey'], array('HS256'));
$roundTrip = JWT::decode($payload, new Key($testConfig['signingKey'], 'HS256'));
$this->assertEquals($roundTrip->iss, $testConfig['issuer']);
$this->assertEquals($roundTrip->aud, $testConfig['audience']);
$this->assertEquals($roundTrip->scope, $testConfig['scope']);
Expand All @@ -500,7 +507,7 @@ public function testCanRS256EncodeAValidPayload()
$o->setSigningAlgorithm('RS256');
$o->setSigningKey($privateKey);
$payload = $o->toJwt();
$roundTrip = JWT::decode($payload, $publicKey, array('RS256'));
$roundTrip = JWT::decode($payload, new Key($publicKey, 'RS256'));
$this->assertEquals($roundTrip->iss, $testConfig['issuer']);
$this->assertEquals($roundTrip->aud, $testConfig['audience']);
$this->assertEquals($roundTrip->scope, $testConfig['scope']);
Expand All @@ -517,7 +524,7 @@ public function testCanHaveAdditionalClaims()
$o->setSigningAlgorithm('RS256');
$o->setSigningKey($privateKey);
$payload = $o->toJwt();
$roundTrip = JWT::decode($payload, $publicKey, array('RS256'));
$roundTrip = JWT::decode($payload, new Key($publicKey, 'RS256'));
$this->assertEquals($roundTrip->target_audience, $targetAud);
}
}
Expand Down Expand Up @@ -907,7 +914,7 @@ public function testFailsIfIdTokenIsInvalid()
$not_a_jwt = 'not a jot';
$o = new OAuth2($testConfig);
$o->setIdToken($not_a_jwt);
$o->verifyIdToken($this->publicKey);
$o->verifyIdToken($this->publicKey, 'RS256');
}

public function testFailsIfAudienceIsMissing()
Expand All @@ -923,7 +930,7 @@ public function testFailsIfAudienceIsMissing()
$o = new OAuth2($testConfig);
$jwtIdToken = JWT::encode($origIdToken, $this->privateKey, 'RS256');
$o->setIdToken($jwtIdToken);
$o->verifyIdToken($this->publicKey, ['RS256']);
$o->verifyIdToken($this->publicKey, 'RS256');
}

public function testFailsIfAudienceIsWrong()
Expand All @@ -940,7 +947,7 @@ public function testFailsIfAudienceIsWrong()
$o = new OAuth2($testConfig);
$jwtIdToken = JWT::encode($origIdToken, $this->privateKey, 'RS256');
$o->setIdToken($jwtIdToken);
$o->verifyIdToken($this->publicKey, ['RS256']);
$o->verifyIdToken($this->publicKey, 'RS256');
}

public function testShouldReturnAValidIdToken()
Expand All @@ -957,7 +964,7 @@ public function testShouldReturnAValidIdToken()
$alg = 'RS256';
$jwtIdToken = JWT::encode($origIdToken, $this->privateKey, $alg);
$o->setIdToken($jwtIdToken);
$roundTrip = $o->verifyIdToken($this->publicKey, array($alg));
$roundTrip = $o->verifyIdToken($this->publicKey, $alg);
$this->assertEquals($origIdToken['aud'], $roundTrip->aud);
}
}